@dexterai/connect 0.15.0 → 0.16.0

package/dist/{chunk-RLVMYLHC.js → chunk-Y22JFT53.js}

@@ -411,6 +411,10 @@ function bytesToBase64(bytes) {
 function bytesToBase64url(bytes) {
   return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+function base64urlToBase64(s) {
+  const t = s.replace(/-/g, "+").replace(/_/g, "/");
+  return t + "=".repeat((4 - t.length % 4) % 4);
+}
 function compactSignatureToDer(compact) {
   if (compact.length !== 64) {
     throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
@@ -622,6 +626,8 @@ export {
   createWallet,
   passkeyLogin,
   continueWithDexter,
+  bytesToBase64url,
+  base64urlToBase64,
   createAnonServerPolicy,
   createPasskeySigner,
   resolveIdentity,

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as ConnectVault, D as DexterConnectConfig, a as CeremonyPhase, S as SignInResult } from './signals-BuP-7inZ.js';
-export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, I as IdentityInput, c as IdentityKind, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-BuP-7inZ.js';
+import { C as ConnectVault, D as DexterConnectConfig, a as CeremonyPhase, S as SignInResult, I as IdentityKind } from './signals-BaXobUfB.js';
+export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, c as IdentityInput, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-BaXobUfB.js';
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
 
 interface CreateWalletConfig extends DexterConnectConfig {
@@ -116,4 +116,135 @@ declare function createPasskeySigner(vault: ConnectVault, apiBase?: string, opts
  */
 declare function ceremonyPhaseLabel(phase: CeremonyPhase): string;
 
-export { type AnonChallengeResult, type AnonServerPolicy, CeremonyPhase, ConnectVault, type ContinueResult, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, SignInResult, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, createWallet, passkeyLogin };
+/** The automatic role-2 agent-spend rail. */
+interface AutomaticAgentSpend {
+    /** true = agent-spend is ON (not revoked). Derived from revokedAt === null. */
+    active: boolean;
+    /** ISO timestamp the rail was revoked, or null when active. */
+    revokedAt: string | null;
+    /**
+     * On-chain role-2 arm state, decoded from authority.signer by the backend:
+     *   true  = armed (the rail is live and can spend)
+     *   false = dormant (granted but not yet armed — arms on first pay)
+     *   null  = indeterminate (vault not activated, or a transient chain read failed)
+     * NEVER derived from liveSessionCount (that counts the wrong session model).
+     */
+    armed: boolean | null;
+    spentTodayAtomic?: string;
+    dailyCapAtomic?: string;
+    perCallCapAtomic?: string;
+    lifetimeSpentAtomic?: string;
+}
+/** One explicit user-opened Tab (a V6 per-counterparty session). */
+interface AgentSpendTab {
+    /** The session pubkey — the handle a Tab revoke targets. */
+    id: string;
+    /** The counterparty (agent/app) address this Tab authorizes. */
+    counterparty: string;
+    /** Display label: the Dexter-verified app name, else a shortened address. */
+    label: string;
+    /** Whether the Tab is currently live (not expired/spent-out/revoked). */
+    live: boolean;
+    /** Spent so far against this Tab's cap, atomic USDC (6dp) string. */
+    spentAtomic: string;
+    /** This Tab's spending cap, atomic USDC (6dp) string. */
+    capAtomic: string;
+    /** Unix seconds when the Tab expires. */
+    expiresAt: number;
+}
+/** The honest two-mode status: one balance, two separately-accounted rails. */
+interface AgentSpendStatus {
+    /** Vault USDC balance, atomic (6dp) string — the ONE pool both rails draw. */
+    balanceAtomic: string | null;
+    /** The automatic role-2 rail. */
+    automatic: AutomaticAgentSpend;
+    /** The explicit Tabs. */
+    tabs: AgentSpendTab[];
+}
+/** The fields of GET /status the two-mode read consumes. */
+interface RawAgentSpendStatus {
+    /** ISO timestamp when revoked, null when active. Top-level on /status. */
+    agentSpendRevokedAt?: string | null;
+    /** On-chain armed read (authority.signer). true/false/null. Top-level on /status. */
+    agentSpendArmed?: boolean | null;
+    /** On-chain block; usdcAtomic is the vault balance. */
+    onchain?: {
+        usdcAtomic?: string | null;
+        /** Present but DELIBERATELY UNUSED here — counts the wrong session model. */
+        liveSessionCount?: number;
+    } | null;
+    agentSpendDaily?: {
+        spentTodayAtomic?: string;
+        dailyCapAtomic?: string;
+        perCallCapAtomic?: string;
+        lifetimeSpentAtomic?: string;
+    } | null;
+}
+/** The fields of one GET /sessions row the Tabs rail consumes. */
+interface RawAgentSpendSession {
+    sessionPubkey: string;
+    counterparty: string;
+    appName?: string | null;
+    live: boolean;
+    spent: string;
+    maxAmount: string;
+    expiresAt: number;
+}
+/**
+ * Assemble the honest two-mode agent-spend status from the raw /status response
+ * and the raw /sessions rows. Pure: no fetch, no clock, no I/O.
+ */
+declare function assembleAgentSpendStatus(status: RawAgentSpendStatus, sessions?: RawAgentSpendSession[]): AgentSpendStatus;
+/**
+ * The minimal identity the off/on switch needs: WHO is active + the wallet
+ * handle the anon router keys on. Structurally satisfied by connect's
+ * ResolvedIdentity (pass it straight through), or hand-build `{ kind, userHandle }`.
+ */
+interface AgentSpendIdentity {
+    /** Passkey-vault-first identity axis. Agent-spend is Dexter-Wallet-only. */
+    kind: IdentityKind;
+    /** The passkey-vault user handle the anon router addresses, or null. */
+    userHandle: string | null;
+}
+/** Typed error whose `code` is the server's snake_case error string. */
+declare class AgentSpendError extends Error {
+    readonly code: string;
+    constructor(code: string, message?: string);
+}
+/** Map an AgentSpendError.code to plain, user-facing copy. */
+declare function describeAgentSpendError(code: string): string;
+interface RevokeAgentSpendResult {
+    revoked: boolean;
+}
+/**
+ * Revoke the AUTOMATIC role-2 agent-spend rail — the off-switch. Takes effect on
+ * the very next agent payment (the spend path reads agent_spend_revoked_at fresh
+ * per spend). Dexter-Wallet (anon-vault) only; `credentialId` (base64url) targets
+ * the biometric prompt.
+ *
+ * @param id            WHO is active — must be the passkey-vault (Dexter Wallet).
+ * @param vaultPda      The vault PDA, base58 string. Becomes the signed message.
+ * @param apiOrigin     The dexter-api origin (e.g. https://api.dexter.cash). The
+ *                      caller owns env; connect reads none.
+ * @param credentialId  The wallet's passkey credential id (base64url), to make
+ *                      the assertion a direct biometric, not an account picker.
+ */
+declare function revokeAgentSpend(id: AgentSpendIdentity, vaultPda: string, apiOrigin: string, credentialId?: string | null): Promise<RevokeAgentSpendResult>;
+interface EnableAgentSpendResult {
+    enabled: boolean;
+}
+/**
+ * Re-enable the AUTOMATIC role-2 agent-spend rail — the ON switch. Turning spend
+ * back ON is the dangerous direction, so it is a two-step, replay-protected nonce
+ * flow: fetch a server-minted nonce+expiry (inert until redeemed), sign
+ * enableAgentSpendMessage over those EXACT values as the WebAuthn challenge,
+ * submit. Dexter-Wallet (anon-vault) only.
+ *
+ * @param id            WHO is active — must be the passkey-vault (Dexter Wallet).
+ * @param vaultPda      The vault PDA, base58 string.
+ * @param apiOrigin     The dexter-api origin (e.g. https://api.dexter.cash).
+ * @param credentialId  The wallet's passkey credential id (base64url).
+ */
+declare function enableAgentSpend(id: AgentSpendIdentity, vaultPda: string, apiOrigin: string, credentialId?: string | null): Promise<EnableAgentSpendResult>;
+
+export { AgentSpendError, type AgentSpendIdentity, type AgentSpendStatus, type AgentSpendTab, type AnonChallengeResult, type AnonServerPolicy, type AutomaticAgentSpend, CeremonyPhase, ConnectVault, type ContinueResult, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, type EnableAgentSpendResult, IdentityKind, type RawAgentSpendSession, type RawAgentSpendStatus, type RevokeAgentSpendResult, SignInResult, assembleAgentSpendStatus, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, createWallet, describeAgentSpendError, enableAgentSpend, passkeyLogin, revokeAgentSpend };

package/dist/index.js

@@ -1,6 +1,8 @@
 import {
   ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
+  base64urlToBase64,
+  bytesToBase64url,
   ceremonyPhaseLabel,
   continueWithDexter,
   createAnonServerPolicy,
@@ -20,16 +22,168 @@ import {
   subscribe,
   switchWallet,
   syncAcceptedPasskeys
-} from "./chunk-RLVMYLHC.js";
+} from "./chunk-Y22JFT53.js";
+
+// src/agentSpend.ts
+import { PublicKey } from "@solana/web3.js";
+import { startAuthentication } from "@simplewebauthn/browser";
+import { revokeAgentSpendMessage, enableAgentSpendMessage } from "@dexterai/vault/messages";
+import { DEXTER_VAULT_PROGRAM_ID } from "@dexterai/vault/constants";
+function shortCounterparty(a) {
+  return a.length > 12 ? `${a.slice(0, 4)}\u2026${a.slice(-4)}` : a;
+}
+function assembleAgentSpendStatus(status, sessions = []) {
+  const revokedAt = status.agentSpendRevokedAt ?? null;
+  const daily = status.agentSpendDaily ?? null;
+  const automatic = {
+    active: revokedAt === null,
+    revokedAt,
+    // THE honest read: the dedicated armed field, never liveSessionCount.
+    armed: status.agentSpendArmed ?? null
+  };
+  if (daily) {
+    if (daily.spentTodayAtomic !== void 0) automatic.spentTodayAtomic = daily.spentTodayAtomic;
+    if (daily.dailyCapAtomic !== void 0) automatic.dailyCapAtomic = daily.dailyCapAtomic;
+    if (daily.perCallCapAtomic !== void 0) automatic.perCallCapAtomic = daily.perCallCapAtomic;
+    if (daily.lifetimeSpentAtomic !== void 0) automatic.lifetimeSpentAtomic = daily.lifetimeSpentAtomic;
+  }
+  return {
+    balanceAtomic: status.onchain?.usdcAtomic ?? null,
+    automatic,
+    tabs: sessions.map((s) => ({
+      id: s.sessionPubkey,
+      counterparty: s.counterparty,
+      label: s.appName?.trim() || shortCounterparty(s.counterparty),
+      live: s.live,
+      spentAtomic: s.spent,
+      capAtomic: s.maxAmount,
+      expiresAt: s.expiresAt
+    }))
+  };
+}
+var AgentSpendError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+    this.name = "AgentSpendError";
+  }
+};
+function describeAgentSpendError(code) {
+  switch (code) {
+    case "verification_failed":
+      return "That passkey didn't verify \u2014 try again.";
+    case "missing_fields":
+      return "The request was incomplete \u2014 try again.";
+    case "vault_not_found":
+      return "No wallet found for this passkey.";
+    case "nonce_not_found":
+    case "nonce_already_used":
+      return "That confirmation expired \u2014 tap again to retry.";
+    case "revoke_failed":
+    case "enable_failed":
+      return "The server couldn't complete it \u2014 try again shortly.";
+    case "not_guest":
+      return "This control is only available on a Dexter Wallet.";
+    default:
+      return code;
+  }
+}
+async function agentSpendError(res) {
+  let code = `http_${res.status}`;
+  try {
+    const body = await res.json();
+    if (body?.error) code = String(body.error);
+  } catch {
+  }
+  return new AgentSpendError(code, `agent-spend ${res.status}: ${code}`);
+}
+function assertDexterWallet(id) {
+  if (id.kind !== "passkey-vault") {
+    throw new AgentSpendError("not_guest", "agent-spend off/on switch is Dexter Wallet only");
+  }
+}
+function normalizeOrigin(apiOrigin) {
+  return apiOrigin.trim().replace(/\/$/, "");
+}
+function rpId() {
+  return typeof window !== "undefined" ? window.location.hostname : "dexter.cash";
+}
+async function assertOverMessage(messageBytes, credentialId) {
+  const resp = await startAuthentication({
+    optionsJSON: {
+      challenge: bytesToBase64url(messageBytes),
+      rpId: rpId(),
+      userVerification: "required",
+      ...credentialId ? { allowCredentials: [{ id: credentialId, type: "public-key" }] } : {}
+    }
+  });
+  return {
+    clientDataJSON: base64urlToBase64(resp.response.clientDataJSON),
+    authenticatorData: base64urlToBase64(resp.response.authenticatorData),
+    signature: base64urlToBase64(resp.response.signature)
+  };
+}
+async function revokeAgentSpend(id, vaultPda, apiOrigin, credentialId) {
+  assertDexterWallet(id);
+  const origin = normalizeOrigin(apiOrigin);
+  const message = revokeAgentSpendMessage({
+    programId: DEXTER_VAULT_PROGRAM_ID,
+    vaultPda: new PublicKey(vaultPda)
+  });
+  const signed = await assertOverMessage(message, credentialId);
+  const res = await fetch(`${origin}/api/passkey-vault-anon/revoke-agent-spend`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ userHandle: id.userHandle, signedPasskeyPayload: signed })
+  });
+  if (!res.ok) throw await agentSpendError(res);
+  return await res.json();
+}
+async function enableAgentSpend(id, vaultPda, apiOrigin, credentialId) {
+  assertDexterWallet(id);
+  const origin = normalizeOrigin(apiOrigin);
+  const challengeRes = await fetch(
+    `${origin}/api/passkey-vault-anon/enable-agent-spend/challenge`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ userHandle: id.userHandle })
+    }
+  );
+  if (!challengeRes.ok) throw await agentSpendError(challengeRes);
+  const { nonce, expiry } = await challengeRes.json();
+  const message = enableAgentSpendMessage({
+    programId: DEXTER_VAULT_PROGRAM_ID,
+    vaultPda: new PublicKey(vaultPda),
+    nonce: BigInt(nonce),
+    expiry: BigInt(expiry)
+  });
+  const signed = await assertOverMessage(message, credentialId);
+  const verifyRes = await fetch(
+    `${origin}/api/passkey-vault-anon/enable-agent-spend/verify`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ userHandle: id.userHandle, nonce, signedPasskeyPayload: signed })
+    }
+  );
+  if (!verifyRes.ok) throw await agentSpendError(verifyRes);
+  return await verifyRes.json();
+}
 export {
   ACTIVE_WALLET_STORAGE_KEY,
+  AgentSpendError,
   ConnectError,
+  assembleAgentSpendStatus,
   ceremonyPhaseLabel,
   continueWithDexter,
   createAnonServerPolicy,
   createPasskeySigner,
   createWallet,
+  describeAgentSpendError,
   ejectActiveWallet,
+  enableAgentSpend,
   forgetWallet,
   getActiveHandle,
   getCredentialId,
@@ -39,6 +193,7 @@ export {
   prunePasskey,
   renamePasskey,
   resolveIdentity,
+  revokeAgentSpend,
   setActiveHandle,
   subscribe as subscribeWallet,
   switchWallet,

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
-import { a as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-BuP-7inZ.js';
+import { a as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-BaXobUfB.js';
 import { ReactElement, ReactNode } from 'react';
 
 type ConnectStatus = 'idle' | 'pending' | 'done' | 'error';

package/dist/react.js

@@ -14,7 +14,7 @@ import {
   setActiveHandle,
   subscribe,
   switchWallet
-} from "./chunk-RLVMYLHC.js";
+} from "./chunk-Y22JFT53.js";
 
 // src/useSignInWithDexter.ts
 import { useCallback, useEffect, useMemo, useState } from "react";

package/dist/{signals-BuP-7inZ.d.ts → signals-BaXobUfB.d.ts}

@@ -180,4 +180,4 @@ declare function syncAcceptedPasskeys(args: {
     rpId?: string;
 }): Promise<boolean>;
 
-export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type IdentityInput as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CeremonyPhase as a, ConnectError as b, type IdentityKind as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };
+export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type IdentityKind as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CeremonyPhase as a, ConnectError as b, type IdentityInput as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {
@@ -22,11 +22,18 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@dexterai/vault": ">=0.19",
+    "@dexterai/vault": ">=0.22",
+    "@solana/web3.js": "^1.98.0",
     "react": ">=18"
   },
+  "peerDependenciesMeta": {
+    "@solana/web3.js": {
+      "optional": true
+    }
+  },
   "devDependencies": {
-    "@dexterai/vault": "^0.19.0",
+    "@dexterai/vault": "^0.24.0",
+    "@solana/web3.js": "^1.98.4",
     "@types/react": "^19.1.12",
     "react": "^19.2.5",
     "tsup": "^8.5.0",